AI-enabled cyber attackers are able to check every side door of an application at a scale and speed unimaginable before. AI can help defenders just as much…but it’s only as effective as the human expertise guiding it. In this session, Xint co-founder and CTO Andrew Wesie explains how human engineering in harness construction is the determining factor between real, autonomous exploit discovery and validation versus a machine that just generates more noise.
Segment Resources:
High-impact business logic vulnerabilities discovered by Xint: one bug that enabled large scale model reasoning distillation and another that enabled cutting output inference costs by 99% on OpenAI https://xint.io/blog/compaction-smuggling-reasoning-traces and https://xint.io/blog/openai-compaction-inference
How Woori Bank was the only Korean bank to avoid being breached during the most widespread attack on Korean financial system in part through their work with Xint to secure side doors https://xint.io/resources/the-side-door-problem-what-the-korean-bank-breaches-mean-for-us-banks
Working with DARPA to test all the surrounding infrastructure to messaging apps used in the military whether they have access to source code or not https://xint.io/blog/darpa-selects-xint-to-research-source-code-vulnerabilities-in-critical-messaging-applications-used-in-military-communications-330339
Team Xint won $240k at Pwn2Own Ireland in October, successfully 5/5 on their exploit submissions (on first attempts too), including the Home Assistant Green, Google Pixel 10, Oracle Autonomous AI Database, LiteLLM, and Philips Hue Bridge Pro and was the first team to successfully hack the Pixel 10 https://x.com/xint_official/status/2108585751512526887
This segment is sponsored by Xint. Visit https://securityweekly.com/xint to learn more about them!
- 0:00 - Introduction – Andrew Wei of Zint
- 0:25 - Using AI Agents to Find Business Logic Vulnerabilities
- 01:30 - Models vs. Harnesses: What Makes AI Security Testing Effective?
- 02:57 - The Role of Human Expertise in AI-Powered Pen Testing
- 05:16 - Understanding AI Model Capabilities vs. Attacker Capabilities
- 06:07 - Why AI Security Testing Needs Context and Evaluation
- 08:07 - Finding Vulnerabilities in Billions of Lines of Legacy Code
- 10:17 - Real-World Vulnerability Discoveries: Copy Fail and Beyond
- 11:38 - The Challenge of Fixing Complex Software Vulnerabilities
- 12:30 - Using AI to Triage and Prioritize Security Vulnerabilities
- 14:16 - Will AI Replace Human Pen Testers?
- 15:48 - Getting Started in Penetration Testing: Skills and Fundamentals
- 16:46 - Why Critical Thinking and Human Creativity Still Matter
- 17:06 - Closing Remarks and OWASP AppSec Conference Coverage
Andrew Wesie is Co-Founder and CTO at Xint, where he leads technical strategy, product development, and offensive security research. He has deep expertise in vulnerability research, exploitation, and advanced security engineering, and has supported high-impact security work across some of the world’s most targeted platforms. Xint is an AI-native security platform designed to identify critical zero-day vulnerabilities at scale without human intervention.
